CVE-2026-77783: Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
Published Sep 2, 2026
·Updated
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts.
Affected Software
1 affected component
Rank Math SEO<1.0.277
Event History
Sep 2, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Which posts can be exposed?
Unauthenticated visitors may be able to disclose schema and associated content from draft, pending, private, scheduled, and password-protected posts.
2
Does an attacker need an account or authentication to exploit this?
No. The issue is exploitable by unauthenticated visitors.
3
What versions are affected?
Rank Math SEO versions before 1.0.277 are affected.